More Like this

1. Employing attack graphs for intrusion detection

   https://doi.org/10.1145/3368860.3368862  

   Capobianco, Frank; George, Rahul; Huang, Kaiming; Jaeger, Trent; Krishnamurthy, Srikanth; Qian, Zhiyun; Payer, Mathias; Yu, Paul (September 2019, New Security Paradigms Workshop)

   Intrusion detection systems are a commonly deployed defense that examines network traffic, host operations, or both to detect attacks. However, more attacks bypass IDS defenses each year, and with the sophistication of attacks increasing as well, we must examine new perspectives for intrusion detection. Current intrusion detection systems focus on known attacks and/or vulnerabilities, limiting their ability to identify new attacks, and lack the visibility into all system components necessary to confirm attacks accurately, particularly programs. To change the landscape of intrusion detection, we propose that future IDSs track how attacks evolve across system layers by adapting the concept of attack graphs. Attack graphs were proposed to study how multi-stage attacks could be launched by exploiting known vulnerabilities. Instead of constructing attacks reactively, we propose to apply attack graphs proactively to detect sequences of events that fulfill the requirements for vulnerability exploitation. Using this insight, we examine how to generate modular attack graphs automatically that relate adversary accessibility for each component, called its attack surface, to flaws that provide adversaries with permissions that create threats, called attack states, and exploit operations from those threats, called attack actions. We evaluate the proposed approach by applying it to two case studies: (1) attacks on file retrieval, such as TOCTTOU attacks, and (2) attacks propagated among processes, such as attacks on Shellshock vulnerabilities. In these case studies, we demonstrate how to leverage existing tools to compute attack graphs automatically and assess the effectiveness of these tools for building complete attack graphs. While we identify some research areas, we also find several reasons why attack graphs can provide a valuable foundation for improving future intrusion detection systems. 

   more » « less
2. Network Intrusion Detection and Machine Learning

   Magee, J.; Boonthum-Denecke, C. (January 2021, ADMI 2021: The Symposium of Computing at Minority Institutions)

   null (Ed.)

   Overall, this document will serve as an analysis of the combination between machine learning principles and computer network analysis in their ability to detect a network anomaly, such as a network attack. The research provided in this document will highlight the key elements of network analysis and provide an overview of common network analysis techniques. Specifically, this document will highlight a study conducted by the University of Luxembourg and an attempt to recreate the study with a slightly different list of parameters against a different dataset for network anomaly detection using NetFlow data. Alongside network analysis, is the emerging field of machine learning. This document will be investigating common machine learning techniques and implement a support vector machine algorithm to detect anomaly and intrusion within the network. MatLab was an utilized machine learning tool for identifying how to coordinate network analysis data with Support Vector Machines. The resulting graphs represent tests conducted using Support vector machines in a method similar to that of the University of Luxembourg. The difference between the tests is within the metrics used for anomaly detection. The University of Luxembourg utilized the IP addresses and the volume of traffic of a specific NetFlow dataset. The resulting graphs utilize a metric based on the duration of transmitted bytes, and the ratio of the incoming and outgoing bytes during the transmission. The algorithm created and defined metrics proved to not be as efficient as planned against the NetFlow dataset. The use of the conducted tests did not provide a clear classification of an anomaly. However, many other factors contributing to network anomalies were highlighted. 

   more » « less
3. Saltwater Intrusion Intensifies Coastal Permafrost Thaw

   https://doi.org/10.1029/2021GL094776  

   Guimond, Julia A.; Mohammed, Aaron A.; Walvoord, Michelle A.; Bense, Victor F.; Kurylyk, Barret L. (October 2021, Geophysical Research Letters)

   Abstract Surface effects of sea‐level rise (SLR) in permafrost regions are obvious where increasingly iceless seas erode and inundate coastlines. SLR also drives saltwater intrusion, but subsurface impacts on permafrost‐bound coastlines are unseen and unclear due to limited field data and the absence of models that include salinity‐dependent groundwater flow with solute exclusion and freeze‐thaw dynamics. Here, we develop a numerical model with the aforementioned processes to investigate climate change impacts on coastal permafrost. We find that SLR drives lateral permafrost thaw due to depressed freezing temperatures from saltwater intrusion, whereas warming drives top‐down thaw. Under high SLR and low warming scenarios, thaw driven by SLR exceeds warming‐driven thaw when normalized to the influenced surface area. Results highlight an overlooked feedback mechanism between SLR and permafrost thaw with potential implications for coastal infrastructure, ocean‐aquifer interactions, and carbon mobilization. 

   more » « less
4. Reconfigurable CAN Intrusion Detection and Response System

   https://doi.org/10.3390/electronics13132672  

   Saini, Rachit; Islam, Riadul (July 2024, Electronics)

   The controller area network (CAN) remains the de facto standard for intra-vehicular communication. CAN enables reliable communication between various microcontrollers and vehicle devices without a central computer, which is essential for sustainable transportation systems. However, it poses some serious security threats due to the nature of communication. According to caranddriver.com, there were at least 150 automotive cybersecurity incidents in 2019, a 94% year-over-year increase since 2016, according to a report from Upstream Security. To safeguard vehicles from such attacks, securing CAN communication, which is the most relied-on in-vehicle network (IVN), should be configured with modifications. In this paper, we developed a configurable CAN communication protocol to secure CAN with a hardware prototype for rapidly prototyping attacks, intrusion detection systems, and response systems. We used a field programmable gate array (FPGA) to prototype CAN to improve reconfigurability. This project focuses on attack detection and response in the case of bus-off attacks. This paper introduces two main modules: the multiple generic errors module with the introduction of the error state machine (MGEESM) module and the bus-off attack detection (BOAD) module for a frame size of 111 bits (BOAD111), based on the CAN protocol presenting the introduction of form error, CRC error, and bit error. Our results show that, in the scenario with the transmit error counter (TEC) value 127 for switching between the error-passive state and bus-off state, the detection times for form error, CRC error, and bit error introduced in the MGEESM module are 3.610 ms, 3.550 ms, and 3.280 ms, respectively, with the introduction of error in consecutive frames. The detection time for BOAD111 module in the same scenario is 3.247 ms. 

   more » « less
5. Towards Effective Virtualization of Intrusion Detection Systems

   https://doi.org/10.1145/3040992.3041004  

   Zhang, Nuyun; Li, Hongda; Hu, Hongxin; Park, Younghee (January 2017, Proceedings of the ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization)

   Traditional Intrusion Detection Systems (IDSes) are generally implemented on vendor proprietary appliances or middleboxes, which usually lack a general programming interface, and their versatility and flexibility are also very poor. Emerging Network Function Virtualization (NFV) technology can virtualize IDSes and elastically scale them to deal with attack traffic variations. However, existing NFV solutions treat a virtualized IDS as a monolithic piece of software, which could lead to inflexibility and significant waste of resources. In this paper, we propose a novel approach to virtualize IDSes as microservices where the virtualized IDSes can be customized on demand, and the underlying microservices could be shared and scaled independently. We also conduct experiments, which demonstrate that virtualizing IDSes as microservices can gain greater flexibility and resource efficiency. 

   more » « less